Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for deploying ComplianceAsCode/compliance-operator #176

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Add support for deploying ComplianceAsCode/compliance-operator #176

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -96,6 +96,12 @@ deploy: $(TOOLS_DIR)/kubectl
undeploy: $(TOOLS_DIR)/kubectl
$(KUBECTL) delete -k kustomize

# Basic installation of ComplianceAsCode/compliance-operator so we can use the
# same cluster for generating results for the compserv.
.PHONY: deploy-co
deploy-co: $(TOOLS_DIR)/kubectl
$(KUBECTL) apply -k kustomize/compliance-operator

$(TOOLS_DIR)/kubectl: $(TOOLS_DIR)
# Check if tools/kubectl exists - if it does then the default value provided
# above will work.
Expand Down
5 changes: 5 additions & 0 deletions kustomize/compliance-operator/kustomization.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
namespace: openshift-compliance
resources:
- namespace.yaml
- operator-group.yaml
- subscription.yaml
4 changes: 4 additions & 0 deletions kustomize/compliance-operator/namespace.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
apiVersion: v1
kind: Namespace
metadata:
name: openshift-compliance
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does this work with 4.12? I would assume that you need to add:

+    pod-security.kubernetes.io/audit: privileged
+    pod-security.kubernetes.io/enforce: privileged
+    pod-security.kubernetes.io/warn: privileged

to account for the PSA changes.

(side node: we might want to bump the CI cluster to 4.12 this close to 4.12 feature freeze to catch issues early)

Copy link
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good call - I'm running this on 4.11.

Want me to do that bump here or a separate patch?

8 changes: 8 additions & 0 deletions kustomize/compliance-operator/operator-group.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
apiVersion: operators.coreos.com/v1
kind: OperatorGroup
metadata:
name: compliance-operator
namespace: openshift-compliance
spec:
targetNamespaces:
- openshift-compliance
11 changes: 11 additions & 0 deletions kustomize/compliance-operator/subscription.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
name: compliance-operator-sub
namespace: openshift-compliance
spec:
channel: "release-0.1"
installPlanApproval: Automatic
name: compliance-operator
source: redhat-operators
sourceNamespace: openshift-marketplace